The DPA states that Modal will provide 30 days advance notice of subprocessor changes via website update and email notification (if Customer has self-enrolled), but that the only available remedy for a Customer objection to a new subprocessor is termination of the subscription.
This analysis describes what Modal's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Customer cannot block a new subprocessor appointment without exiting the service entirely, and that email notification of subprocessor changes requires Customer to affirmatively self-enroll rather than being automatic. The GDPR Article 28(2) framework permits objection rights but does not prescribe the remedy; the termination-only remedy is the contractual implementation of that right.
Under this clause, Customers who object to a new or replacement subprocessor have only one available remedy: terminating their subscription. To receive proactive email notice of subprocessor changes, Customers must self-enroll at https://trust.modal.com/subprocessors; otherwise, notice is provided only through website updates.
Cross-platform context
See how other platforms handle Subprocessor Objection Limited to Termination and similar clauses.
Compare across platforms →"At least 30 days prior to the addition or replacement of any subcontractor Modal will: (i) update its Subprocessor website at https://trust.modal.com/subprocessors, and (ii) if Customer has self-enrolled to receive email updates, notify Customer of any such intended changes, thereby giving Customer the opportunity to object. Customer's sole recourse if it objects to a Subprocessor will be to terminate its subscription to the Service.Excerpt from Modal's Terms of Service
(1) REGULATORY LANDSCAPE: This provision engages GDPR Article 28(2), which requires that processors obtain controller authorization before engaging subprocessors and provide the controller an opportunity to object.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Customer cannot block a new subprocessor appointment without exiting the service entirely, and that email notification of subprocessor changes requires Customer to affirmatively self-enroll rather than being automatic. The GDPR Article 28(2) framework permits objection rights but does not prescribe the remedy; the termination-only remedy is the contractual implementation of that right.
Under this clause, Customers who object to a new or replacement subprocessor have only one available remedy: terminating their subscription. To receive proactive email notice of subprocessor changes, Customers must self-enroll at https://trust.modal.com/subprocessors; otherwise, notice is provided only through website updates.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Modal.